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1. Transmitted herewith is a SUPPLEMENTAL APPEAL BRIEF in this application, with respect to 
the Notice of Appeal filed on April 20, 2004, and the Appeal Brief filed June 21, 2004, for the 
purpose of re-instating the appeal of the instant matter in view of the latest Office Action mailed 
June 29, 2005. 

2. STATUS OF APPLICANT 

This application is on behalf of a small entity. 
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FEE FOR FILING APPEAL BRIEF 



Pursuant to 37 C.F.R. § 1.17(c), the fee for filing the Appeal Brief is: 



small entity 



$250.00 



Appeal Brief fee due $250.00 



4. EXTENSION OF TERM 

The proceedings herein are for a patent application and the provisions of 37 C J?Jt. § 1.136 apply. 

Applicant believes that no extension of term is required. However, this conditional petition is 
being made to provide for the possibility that applicant has inadvertently overlooked the need for a 
petition and fee for extension of time. 



6, FEE PAYMENT 

Applicant believes no fees are due in view of the fact the fees were paid with the previously 
submitted appeal brief. However if it is determined fees are due, please charge the required fees 
to deposit account 50-1351 (Order No. AMDCP001). 

A duplicate of this transmittal is attached. 
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If any additional extension and/or fee is required, and if any additional fee for claims is required, 
charge Deposit Account No. 50-135 1 (Order No. AMDpEOOlV^ 
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IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 




In re the application of 



Givoly 



) Group Art Unit: 2155 



Application No. 09/924,391 



) Examiner: Tran, Philip B. 



Filed: 



08/07/01 



) Attorney Docket No. AMDCP001 



For: 



SYSTEM, METHOD AND COMPUTER) 



PROGRAM PRODUCT FOR ) 
PROCESSING NETWORK ) 
ACCOUNTING INFORMATION ) 



Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 223 13-1450 

ATTENTION: Board of Patent Appeals and Interferences 

SUPPLEMENTAL APPEAL BRIEF (37 C.F.R. § 41.37) 

This brief is in furtherance of the Notice of Appeal, filed in this case on April 20, 
2004, and the appeal brief filed June 21, 2004, for the purpose of re-instating the 
appeal of the instant matter in view of the latest Office Action mailed June 29, 2005. 

The fees required under § 1 .17, and any required petition for extension of time for filing 
this brief and fees therefor, are dealt with in the accompanying TRANSMITTAL OF 
APPEAL BRIEF. 

This brief contains these items under the following headings, and in the order set forth 
below (37 C.F.R. § 41.37(cX0): 

I REAL PARTY IN INTEREST 

II RELATED APPEALS AND INTERFERENCES 
DI STATUS OF CLAIMS 

IV STATUS OF AMENDMENTS 

V SUMMARY OF CLAIMED SUBJECT MATTER 



'8/17/2005 HBIZUNES 00000008 501351 
U FC-2402 250.00 Dft 



09924391 



PAGE 6162 * RCVD AT 8/1612005 7:31:58 PM [Eastern Daylight Time] * SVR:USPTO-EFXRF-6/25 * DNIS:2738300 * CSID:4089714660 * DURATION (mm-ss):11-02 



"A'UG. 16. 2005 4:42PM Z I LKA-KOTAB, PC 



-2- 



NO. 0014 P. 7/32 



VI ISSUES 

VH ARGUMENTS 

Vin APPENDIX OF CLAIMS INVOLVED IN THE APPEAL 

IX APPENDIX LISTING ANY EVIDENCE RELIED ON BY THE APPELLANT 

IN THE APPEAL 

The final page of this brief bears the practitioner's signature. 
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I REAL PARTY IN INTEREST (37 C.F.R. § 41.37(c)(l)(i)) 
The real party in interest in this appeal is Xacct Technologies, Ltd. 
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H RELATED APPEALS AND INTERFERENCES (37 CFJL § 41.37(c) (l)(u)) 

With respect to other prior or pending appeals, interferences, or related judicial 
proceedings that will directly affect, or be directly affected by, or have a bearing on the 
Board's decision in the pending appeal, there are no other such appeals, interferences, or 
related judicial proceedings. 

Since no such proceedings exist, no Related Proceedings Appendix is appended hereto. 
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HI STATUS OF CLAIMS (37 C.F.R. § 41.37(c) (l)(iB)) 

A. TOTAL NUMBER OF CLAIMS IN APPLICATION 
Claims in the application are: 1, 3-5, 7-11, 13-14, 16-20, and 23 

B. STATUS OF ALL THE CLAIMS IN APPLICATION 

1 . Claims withdrawn from consideration: None 

2. Claims pending: 1, 3-5, 7-1 1, 13-14, 16-20, and 23 

3. Claims allowed: None 

4. Claims rejected: 1, 3-5, 7-1 1, 13-14, 16-20, and 23 

C. CLAIMS ON APPEAL 

The claims on appeal are: 1, 3-5, 7-11, 13-14, 16-20, and 23 
See additional status information in the Appendix of Claims. 
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IV STATUS OF AMENDMENTS (37 C.F.R § 41 J7(c)(l)(iv)) 

As to the status of any amendment filed subsequent to final rejection, there are no such 
amendments after final. 
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V SUMMARY OF CLAIMED SUBJECT MATTER (37 C.F.R. § 4L37(c)(l)(v)) 

With respect to Claim 1 et al, as set forth in Figure 4 and the accompanying 
description of the originally filed specification, a method is provided for processing 
network accounting Information. Accounting information is initially received over a 
packet-switched network. Note operation 402 in Figure 4 and the accompanying 
description. At least one aspect of the received accounting information is then 
monitored. In use, at least a portion of the accounting information that occurs 
during a surge in network traffic is discarded, based on the monitored aspect. Note 
operation 420 in Figure 4 and the accompanying description. Further, the portion of 
the accounting information is discarded to prevent an overload of subsequent 
processing. Note page 5, first paragraph. 

With respect to Claim 1 1 et al. s as set forth in Figure 4 and the accompanying 
description of the originally filed specification, a computer program product is 
provided for processing network accounting information. Accounting information is 
initially received over a packet-switched network. Note operation 402 in Figure 4 
and the accompanying description. At least one aspect of the received accounting 
information is then monitored. In use, at least a portion of the accounting 
information that occurs during a surge in network traffic (and is expendable) is 
discarded, based on the monitored aspect Note operation 420 in Figure 4 and the 
accompanying description. Further, the portion of the accounting information is 
discarded to prevent an overload of subsequent processing. Note page 5, first 
paragraph. Still yet, at least a portion of remaining accounting information is 
allowed to pass to subsequent accounting processing, after receiving the accounting 
information. 

With respect to Claim 20 et al., as set forth in Figure 4 and the accompanying 
description of the originally filed specification, a computer program product is 
provided for processing network accounting information. Accounting information is 
initially received over a packet-switched network. Note operation 402 in Figure 4 
and the accompanying description. At least one aspect of the received accounting 
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information is then monitored. In use, at least a portion of the accounting 
information that occurs during a surge in network traffic (and is expendable) is 
discarded, based on the monitored aspect. Note operation 420 in Figure 4 and the 
accompanying description, Further, the portion of the accounting information is 
discarded to prevent an overload of subsequent processing. Note page 5, first 
paragraph. Still yet, at least a portion of the accounting information is aggregated 
prior to passing to subsequent accounting processing, based on the monitored aspect, 
after receiving the accounting information. Even still, the portions of the accounting 
information are discarded and aggregated to prevent an overload of the subsequent 
accounting processing, and the subsequent accounting processing includes operation 
and business support system processing. Note operation 420 in Figure 4 and the 
accompanying description. 
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VI ISSUES (37 C.F.R. § 41.37(c)(l)(vi)) 



Following, under each issue listed, is a concise statement setting forth the corresponding 
ground of rejection. 

Issue # 1: The Examiner has rejected Claims 1, 3-5, 7-1 1, 13-14, 16-20 and 23 under 
35 U.S.C. 103(a) as being unpatentable over Conklin et al. (USPN 5,991,881) in 
view of Engel et al. (USPN 6,1 15,393). 
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VH ARGUMENTS (37 C.F.R, § 41 J7(c)(l)(vii)) 

The claims of the groups noted below do not stand or fall together. In the present 
section, appellant explains why the claims of each group are believed to be separately 
patentable. 

Issue #1; 

Issue # 1: The Examiner has rejected Claims 1, 3-5, 7-11, 13-14, 16-20 and 23 under 
35 U,S.C. 103(a) as being unpatentable over Conklin et al. (USPN 5,991,881) in 
view of Engel et al. (USPN 6,1 15,393). 

Group #1: Claims 1, 5, 9-70, 18-19, and 23 

To establish a prima facie case of obviousness, three basic criteria must be met. 
Firsts there must be some suggestion or motivation, either in the references 
themselves or in the knowledge generally available to one of ordinary skill in the art, 
to modify the reference or to combine reference teachings. Second, there must be a 
reasonable expectation of success. Finally, the prior art reference (or references 
when combined) must teach or suggest all the claim limitations. The teaching or 
suggestion to make the claimed combination and the reasonable expectation of 
success must both be found in the prior art and not based on appellant's disclosure. 
In re VaectyM F.2d 488, 20 USPQ2d 1438 (Fed.Cir.199l), Appellants respectfully 
assert that at least the first and third elements of the prima facie case of obviousness 
have not been met 

With respect to the first element of the prima facie case of obviousness, the 
Examiner states that it would have been obvious to one of ordinary skill in the art at 
the time of the invention was made to incorporate die teaching of Engel into the 
teaching of Conklin in order to efficiently monitor and control the network account 
information for preventing the overload situation of information in the network 
account information. Appellant respectfully disagrees with this proposition, 
especially in view of the vast evidence to the contrary. 
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Specifically, the Examiner equates, in the latest action, appellant's claimed 
"accounting information" to include the attack data shown in Figure 7 from Conklin, 
in the context of appellant's claimed "discarding at least a portion of the accounting 
information . , . based on the monitored aspect. See below. 




The Examiner then relies on col. 12 9 lines 7-67 from Engel to meet appellant's 
claimed l6 wherein the portion of the accounting information is discarded to prevent 
an overload of subsequent processing." However, the only mention of any sort of 
discarding in such excerpt is as follows: 

^EM 38 also implements a throttle mechanism to limit the rate 
of delivery of alarms to the console based on configured 
limits. This prevents the rapid generation of multiple alarms. 
In essence, Monitor 10 is given a maximum frequency at which 
alarms may be sent to the Workstation. Although alarms in 
excess of the maximum frequency are discarded/ a count ie kept 
of the number of alarms that were discarded." (col. 12, lines 
50-56) 

Thus, it is clear that the Examiner, in the foregoing excerpt, is equating appellant's 
claimed accounting information with EngePs alarms, which are discarded in EngeL 
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To this end, the Examiner's proposed combination attempts to provide the 
functionality associated with the "attack data" of Conklin with the functionality of 
the "alarms" of Engel. To simply glean features associated with alarms, such as that 
of Engel, and combine the same with the non-analogous art of attack data, such as 
that of Conklin would simply be improper. Attack data is used for attempting to 
identify attacks, etc., while alarms provide a notice to a user of some sort of event 

"In order to rely on a reference as a basis for rejection of an appellant's invention, 
the reference must either be in the field of appellant's endeavor or, if not, then be 
reasonably pertinent to the particular problem with which the inventor was 
concerned." In re Oetiker, 977 F2d 1443, 1446> 24 USPQ2d 1443, 1445 (Fed. Cir. 
1992). See also In re Derninski, 796 F.2d 436, 230 USPQ 313 (Fed. Cir. 1996); In re 
Clay, 966 F.2d 656, 659, 23 USPQ2d 1058, 1060-61 (Fed. Cir. 1992) In view of the 
vastly different types of problems attack data addresses as opposed to alarms, the 
Examiner's proposed combination is inappropriate. 

Further, any attempt to incorporate alarm functionality with the collection/use of 
attack data would render an unworkable combination. Alarms are merely notices of 
an "exception," etc. based on various criteria. For example, in Engel, the alarms are 
specifically equipped "to notify the Management Workstation of the occurrence of 
significant events," This is in no way compatible with Ihe attack data 
collection/analysis functionality of Conklin for numerous reasons (e.g. the alarms 
are managed far "downstream" with respect to the data collection, etc.), 

Note, for example, the very different modules that carry out the respective functions 
in Engel (e.g. alarm module 38 vs. RTP 32) and Conklin (e.g. alert notification - Fig, 
6C vs, network observation/detection - Fig. 6A, 6B) below: 
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Even appellant's own disclosure (see below) reflects the vast difference in the 
modules handling data collection/analysis vs. alarms 




FIGURE 3 



Further, the only context in which Conklin even suggests any sort of discarding of 
data is in the following excerpt: 
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*If, there is no indication of an actual or potential 
intrusion, then the examined packet data is discarded. Khea a 
. packet or accumulation of packets match a predefined intrusion 
profile the Xntrusion Detection function identifies the 
network traffic as a reportable activity will construct a data 
structure which contains a date/ time stamp indicating the time 
of detection, the source and destination Internet Protocol 
(IP) addresses, an assigned message identifying the event 
detected. This data structure is passed to the Alert 
Notification function for processing," (see col. 5, lines 23- 
32} 

Thus, while appellant teaches and claims discarding accounting information when 
such accounting information occurs dnriwg a surge in network traffic (which may or 
may not be resulting from an attack), Conklin discards packet data when there is no 
indication of an actual or potential intrusion . Thus, not only do Conklin' s teachings 
fail to meet appellant's claims, but Conklin teaches away from appellant's claimed 
invention (as well as EngePs), thus further rendering it unobvious. In re Hedges, 783 
F.2d 1038, 228 USPQ 685 (Fed. Cir. 1986). 



Appellant thus respectfully asserts that the first element of the prima facie case of 
obviousness has not been met, for at least the reasons set forth hereinabove. 



More importantly, with respect to the third element of the prima facie case of 
obviousness, the Examiner equates, in the latest action, appellant's claimed 
"accounting information-* to include the attack data shown in Figure 7, See below. 
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The Examiner continues by presenting the following argument with respect to 
appellant's claimed "discarding at least a portion of the accounting information ► . . 
based on the monitored aspect" 



Conklin allegedly teaches: "(i.e., network traffic measurement 
and monitoring- for reporting information about captured 
packets and detecting intrusion into the network and into 
computers connected to the network for denial of service) [see 
Abstract and Figs. 6-9 and Col- 1, Line 10 - Col. 2, Line 4.]" 

However, even if the Examiner's statement is true (i.e, that Conklin suggests 
network traffic measurement and monitoring for the Examiner has still not 
shown how Conklin meets appellant's claimed "discarding at least a portion of the 
accounting information that occurs during a surge in network traffic, based on the 
monitored aspect." 

Specifically, the Examiner has not shown how the attack data (which the Examiner 
relies on to meet appellant's claimed "accounting information") is discarded when 
such attack data occurs during a surge in network traffic, based on the monitored 
aspect. 
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Appellant thus respectfully asserts that the third element of the prima facie case of 
obviousness has not been met, since the Examiner's proposed combination does not 
disclose, teach or suggest appellant's claim language, as set forth hereinabove. 

Still yet, the Examiner admits that tc Conklin does not explicitly teach the portion of 
the accounting information is discarded to prevent an overload of subsequent 
processing/' The Examiner then relies on col. 12, lines 7-67 to meet appellant's 
claimed "wherein the portion of the accounting information is discarded to prevent 
an overload of subsequent processing," 

A$ mentioned previously* the only mention of any sort of discarding in such excerpt 
is as follows; 

V EM 38 also implements a throttle mechanism to limit the rate 
of delivery of alarms to the console based on configured 
limits. This prevents the rapid generation of multiple alarms. 
In essence, Monitor 10 is given a maximum frequency at which 
alarms may he sent to the Workstation. Although alarms in 
excess of the maximum frequency are discarded, a count is kept 
of the number of alarms that were discarded . " (col. 12, lines 
50-56) 

Appellant argues that the disclosed "alarms" do not meet appellant's claimed 
"accounting information " Again, in Engel, the alarms are specifically equipped <c to 
notify the Management Workstation of the occurrence of significant events." Such 
notification in no way includes information, let alone accounting; information, as 
claimed by appellant. Further, Engel's discarding is purposed to prevent the rapid 
generation of alarms, which simply does not rise to the level of specificity of 
appellant's claimed discarding to prevent an overload of subsequent processing, as 
claimed. 

Again, appellant thus respectfully asserts that the third element of the prima facie 
case of obviousness has not been met, since the Examiner's proposed combination 
does not disclose, teach or suggest appellant's claim language, as set forth 
hereinabove. 
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Group #2; Claims 3 and 13 

With respect to Claims 3 and 13, the Examiner continues to rely on Figure 6 from 
Conklin to make a prior art showing of appellant's claimed "wherein the accounting 
information is discarded for dealing with heavy network traffic.'* After careful of 
Figure 6, it clearly foils to disclose, teach or even suggest such limitations. Again, 
Conklin deals with network attacks, not "dealing with heavy network traffic," hy 
discarding accounting information, as claimed. 

Again, appellant thus respectfully asserts that the third element of the prima facie 
case of obviousness has not been met, since the Examiner's proposed combination 
does not disclose, teach or suggest appellant's claim language, as set forth 
hereinabove. 

Group #3: Claims 4 and 14 

With respect to Claims 4 and 14, the Examiner relies on col. 4, line 52 - col. 5, line 
45 from Conklin to make a prior art showing of appellant's claimed "generating a 
summary of the accounting information" Such excerpts, however, do not disclose, 
teach or even suggest "accounting information," let alone "generating a summary of 
the accounting information," as claimed. 

Again, appellant thus respectfully asserts that the third element of the prima facie 
case of obviousness has not been met, since the Examiner's proposed combination 
does not disclose, teach or suggest appellant's claim language, as set forth 
hereinabove, 

Group #4: Claims 7 and 16 
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Regarding Claims 7 and 16, the Examiner relies on col. 4, line 30-67; and Figures 6- 
8 from Conklin to make a prior art showing of appellant's claimed "wherein 
monitoring the at least one aspect of the received accounting information includes 
monitoring a rate of receipt of the accounting information/' Such excerpts, 
however, do not disclose, teach or even suggest "a rate of receipt of the accounting 
information," Instead, there is a meTe mention of a time of day, number and types of 
packets, common destination/source address combinations, etc. A number of packets 
constitutes an amount, not a "rate," as claimed. 

Again, appellant thus respectfully asserts that the third element of the prima facie 
case of obviousness has not been met, since the Examiner's proposed combination 
does not disclose, teach or suggest appellant's claim language, as set forth 
hereinabove. 

Group # J; Claims 8 and 1 7 

With respect to Claims 8 and 17, the Examiner relies on coL 4, lines 30-67; and 
Figures 6-8 from Conklin to make a prior art showing of appellant's claimed 
f 'wherein monitoring the at least one aspect of the received accounting information 
includes detecting whether the rate of receipt of the accounting information exceeds 
a predetermined amount." Such excerpts, however, do not even disclose, teach or 
suggest "a rate of receipt of the accounting information." Instead, there is a mere 
mention of a time of day, number and types of packets, common destination/source 
address combinations, etc. It is noted that Conklin does not even suggest a "rate," 
let alone "detecting whether the rate of receipt of the accounting information 
exceeds a predetermined amount " as claimed. 

Yet again, appellant thus respectfully asserts that the third element of the prima facie 
case of obviousness has not been met, since the Examiner's proposed combination 
does not disclose, teach or suggest appellant's claim language, as set forth 
hereinabove, 

Group #5; Claim 11 
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The present group is deemed allowable for, at least in part, the reasons set forth with 
respect to Group #1 . Furthermore, the Examiner has simply dismissed at least a portion 
of the contents of Claim 1 1 under the same rationale set forth above to Claim 1, 
However, Claim 11 includes the following limitations, not found in Claim 1: 

"computer code for discarding at least a portion of the accounting 
information that occurs during a surge in network traffic and is expendable, 
based on the monitored aspect, after receiving the accounting ^formation; 

computer code for allowing at least a portion of rema ining accounting 
information to pass to subsequent accounting processing, after receiving the 
accounting information: 

wherein the portion of the accounting information is discarded to 
prevent an overload of the subsequent accounting processing (emphasis 
added). 

Thus, in the present claim, it is further emphasized that expendable information is 
discarded, while at least a portion of remaining accounting info rmation is allowed to 
pass to subsequent accounting processing , Only appellant teaches and claims such 
technique of ensuring that only a certain type of information, namely expendable 
information, is discarded, for optimizing operation. Further, information (not including 
the expendable information), is allowed to pass, to subsequent accounting processing, so 
that such accounting- specific processing may continue on the remaining accounting 
information, as claimed. 

Still yet again, appellant thus respectfully asserts that the third element of the prima 
facie case of obviousness has not been met, since the Examiner's proposed 
combination does not disclose, teach or suggest appellant's claim language, as set 
forth hereinabove. 

Group #5: Claim 20 
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The present group is deemed allowable for, at least in part, the reasons set forth with 
respect to Group #1. Furthermore, the Examiner has simply dismissed at least a portion 
of the contents of Claim 20 under the same rationale set forth above to Claim 1 . 
However, Claim 20 includes the following limitations, not found in Claim 1 : 

" logic for aggregating at least a portion of the accounting information 
prior to passing to subsequent accounting processing, based on the monitored 
aspect, after receiving the accounting information: 

logic for allowing at least a portion of remaining accounting 
information to pass to the subsequent accounting processing, after receiving 
the accounting information: 

wherein the portions of the accounting information are discarded and 
aggregated to prevent an overload of the subsequent accounting processing; 

wherein the Subsequent accounting processing includes operation and 
business support system processing , (emphasis added)- 

In the present claim, it is further emphasized that an aggregation function is 
implemented in combination with the discarding to prevent an overload of 
subsequent accounting processing. The instant claim further emphasizes the fact 
that the subsequent accounting processing includes operation and business support 
system processing . Only appellant teaches and claims such a combination of 
features and components for preventing an overload of subsequent accounting 
processing. 

Still yet again, appellant thus respectfully asserts that the third element of the prima 
facie case of obviousness has not been met, since the Examinees proposed 
combination does not disclose, teach or suggest appellants claim language, as set 
forth hereinabove. 

In view of the remarks set forth hereinabove, all of the independent claims are deemed 
allowable, along with any claims depending therefrom. 
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Vin APPENDIX OF CLAIMS (37 GFJEt. § 41.37(c)(l)(viii)) 

The text of the claims involved in the appeal (along with associated status information) 
is set forth below: 

1 . (Previously Presented) A method for processing network accounting 
information, comprising: 

(a) receiving accounting information over a packet-switched network; 

(b) monitoring at least one aspect of the received accounting information; and 

(c) after receiving the accounting information, discarding at least a portion of the 
accounting information that occurs during a surge in network traffic, based 
on the monitored aspect; 

wherein the portion of the accounting information is discarded to prevent an 
overload of subsequent processing. 

2. (Cancelled) 

3. (Original) The method as recited in claim 1, wherein the accounting 
information is discarded for dealing with heavy network traffic. 

4. (Original) The method as recited in claim 3, and further comprising 
generating a summary of the accounting information. 

5. (Original) The method as recited in claim 1, wherein monitoring the at least 
one aspect of the received accounting information includes detecting a scan 
of a plurality of ports. 

6. (Cancelled) 

7. (Original) The method as recited in claim 1, wherein monitoring the at least 
one aspect of the received accounting information includes monitoring a rate 
of receipt of the accounting information. 
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8. (Original) The method as recited in claim 7, wherein monitoring the at least 
one aspect of the received accounting information includes detecting whether 
the rate of receipt of the accounting information exceeds a predetermined 
amount. 

9. (Original) The method as recited in claim 1, wherein monitoring the at least 
one aspect of the received accounting information includes monitoring a load 
on a system receiving the accounting information. 

10. (Original) The method as recited in claim 1, wherein the network includes 
the Internet. 

1 1 . (Previously Presented) A computer program product for processing network 
accounting information, comprising: 

computer code for receiving accounting information over a packet-switched 
network; 

computer code for monitoring at least one aspect of the received accounting 
information; and 

computer code for discarding at least a portion of the accounting information 
that occurs during a surge in network traffic and is expendable, based on the 
monitored aspect, after receiving the accounting information; 
computer code for allowing at least a portion of remaining accounting 
information to pass to subsequent accounting processing, after receiving the 
accounting information; 

wherein the portion of the accounting information is discarded to prevent an 
overload of the subsequent accounting processing, 

12. (Cancelled) 

13. (Original) The computer program product as recited in claim 1 1 , wherein the 
accounting information is discarded for dealing with heavy network traffic. 
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14. (Original) The computer program product as recited in claim 1 3, and further 
comprising computer code for generating a summary of the accounting 
information, 

15. (Cancelled) 

16. (Original) The computer program product as recited in claim 1 1 T wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for monitoring a rate of 
receipt of the accounting information, 

17. (Original) The computer program product as recited in claim 16, wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for detecting whether the 
rate of receipt of the accounting information exceeds a predetermined 
amount, 

1 8. (Original) The computer program product as recited in claim 1 1 , wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for detecting a scan of a 
plurality of ports. 

19. (Original) The computer program product as recited in claim 11, wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for monitoring a load on a 
system receiving the accounting information. 
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20. (Previously Presented) A system for processing network accounting 
information, comprising: 

logic for receiving accounting information over a packet-switched network; 
logic for monitoring at least one aspect of the received accounting 
information; and 

logic for discarding at least a portion of the accounting information that 
occurs during a surge in network traffic and is expendable, based on the 
monitored aspect, after receiving the accounting information; 
logic for aggregating at least a portion of the accounting information prior to 
passing to subsequent accounting processing, based on the monitored aspect, 
after receiving the accounting information; 

logic for allowing at least a portion of remaining accounting information to 
pass to the subsequent accounting processing, after receiving the accounting 
information; 

wherein the portions of the accounting information are discarded and 
aggregated to prevent an overload of the subsequent accounting processing; 
wherein the subsequent accounting processing includes operation and 
business support system processing. 

2L (Cancelled) 

22. (Cancelled) 

23 , (Previously Presented) A method for processing network accounting 
information, comprising: 

(a) receiving accounting information over a packet-switched network; 

(b) detecting a scan of a plurality of ports; 

(c) detecting a scan of a plurality of Internet Protocol (IP) addresses; 

(d) detecting a rate of receipt of the accounting information; 

(e) detecting whether the rate of receipt of the accounting information exceeds a 
predetermined amount; 

(f) detecting a load on a system receiving the accounting information; 
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(g) conditionally preventing an overload of the accounting information based on 
aspects detected during steps (b)-(f) by discarding at least a portion of the 
accounting information after the receipt thereof to prevent an overload of 
subsequent accounting processing; and 

(h) generating a summary of the accounting information; 

(i) wherein the accounting information that occurs during a surge in network traffic 
is discarded. 
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IX APPENDIX LISTING ANY EVIDENCE RELIED ON BY THE APPELLANT 
IN THE APPEAL (37 C.F.R. § 41.37(c)(l)(ix)) 

There is no such evidence. 
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In the event a telephone conversation would expedite the prosecution of this application, the 
Examiner may reach the undersigned at (408) 971-2573 , For payment of any additional fees due in 




Zilka-Kotab, P.C. 

P.O. Box 721120 

San Jose, California 95172-1120 

Telephone: (408) 971-2573 

Facsimile: (408)971-4660 
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